Senior Information Security Analyst, Third-Party Security and Data Breach Expert (T & I) (Telework/Hybrid)

Role overview

Workplace and location

• This is a hybrid position combining in-office and remote work.
• The position can be based in Montreal or Toronto.

Key responsibilities

• Lead the organization-wide Third-Party Risk Management program from process development through operational implementation.
• Define vendor risk classification frameworks and security assessment questionnaires aligned with industry standards.
• Review third-party security posture using SOC 2 Type II reports, ISO 27001 certifications, penetration tests, and regulatory attestations.
• Develop vendor remediation plans, compensating controls, and contractual security requirements.
• Provide technical leadership during third-party security incidents and data breaches.
• Maintain third-party risk registers, inventories, periodic reassessments, governance dashboards, KPIs, and KRIs.

Requirements

• A university degree in computer science, information technology, information security, or a related field is required.
• At least five years of IT risk governance and TPRM experience, including at least three years focused on information security, is required.
• Experience with compliance programs, contractual security requirements, and communication with legal and non-technical stakeholders is required.
• Bilingualism in English and French is essential.

Technical expertise

• Knowledge of ISO/IEC 27001, 27002, 27005, NIST SP 800-53 or 800-161, COBIT, and ITIL is required.
• Expertise in cloud and web architecture security, network security, firewalls, IDS/IPS, DNS, web filtering, and encryption is required.
• Knowledge of database architecture, secure software development, business continuity, disaster recovery, operational resilience, and physical security is required.
• CISSP, CRISC, CBCP, CISA, CISM, or an equivalent security certification is an asset.

Recruitment checks